# Docker Socket Proxy

Docker Socket Proxy is a self-hosted network services app. A security proxy that sits between Docker containers and the Docker socket. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/373/docker-socket-proxy

## Description

A security proxy that sits between Docker containers and the Docker socket. It exposes only the specific Docker socket API endpoints each container is allowed to use, based on environment variables, instead of granting the container full root-equivalent control of the host daemon. It is built for homelab and server operators who must hand out socket access to monitoring, backup, or orchestration tools, and it is worth using to contain the security risk of exposing /var/run/docker.sock.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

54/100 (Fair), based on 4 of 4 factors.
- Maintained: 67 (last commit 80 days ago)
- Popular: 69 (2,815 GitHub stars)
- Easy to install: 20 (1 install platform, Docker image)
- Light to run: 40 (4 GB minimum RAM, runs on ARM)

## Links

- GitHub: https://github.com/Tecnativa/docker-socket-proxy
- Docker Hub: https://hub.docker.com/r/tecnativa/docker-socket-proxy
- Unraid: https://ca.unraid.net/apps/dockersocket-09jr3hv0j7k93r?q=dockersocket

## Common questions

### Do I need to run the Docker socket proxy with the privileged flag?

Yes, the README says --privileged is required because it connects to the Docker socket. That socket connection can be treated as privileged in some SELinux or AppArmor contexts.

### How do I restrict which Docker API sections can pass through?

Set the relevant environment variables to 0 to revoke access or 1 to grant it. The variables normally match the API URL prefix, and blocked requests get an HTTP 403 Forbidden response.

### Should I expose the proxy's port to the public network?

No, the README says to keep it out of public networks. It should only be reachable from Docker networks that contain the proxy and the service using it.

---
Source: Our Local Host (https://ourlocalhost.com/app/373/docker-socket-proxy), the self-hosted and open-source app directory.